Windows Forum

Ask something
Discussion Locked

Active Directory Domain's

0 helpful
6 replies

by mdelacruz

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We are Installing Active directory on two decentralize management site US and France sites.

Questions

1.Since we have two decentralize Sites.
Would it be more manageable to create domain for US sites starting with "US.MyCompany.com" and "France.MyCompany.com" for france domains And leave out MyCompany.com domain?

2.What harm would it do if the MyCompany.com domain doesn't exist in the Domains active directory?

3.Are both domains are considered to be a forest since they don't have the MyCompany.com domain?

4.Do I have to enable trust relation between domains to share resoures on both sites?

5.What is your suggestion to this scenario to better deployed active directory on two decentralize sites?

6 replies

by ntoz

1. Depending upon what your bandwidth resouces are security needs, and size considerations, you could have one domain, mycompany.com and use OU's to accomplish the same thing your trying to do, with one domain and one DNS zone. That would be cake. The fact that one domain can contain millions of objects, its unlikly you would run out of space. If you planned your sites and and connectors carefuly this would work without having to divide your company up at all. I would however plan a mycompany.com with a second level domain, say corporate.mycompany.com. In this case you would be able to be more flexable. Your first domain in the forest is forever. If you leave it empty with the exception of administative tasks, you can hang as many domains under it you like. If it becomes a consern that you have to many users in the second level domain you can easily split that domain into separate domains at a later time, if you screw up with your top level domain, your toast. If bandwidth were an issue, which in this case it might, or in this case also political and regulatory issues, I would move again to haveing mycompany.com with two subdomains for the same reasons first mentioned, the first domain in the tree is it!

by ntoz

2. I think your confusing Active Directory and DNS. If the DNS zone of mycompany.com didnt exit, you would have problems with users from each domain trying to reach each other, users from outside your organization wouldnt be able to connect to reasources at either site in most cases using dns name resolution. Active directory on the other hand, while its better to try and use the same AD names as DNS names, if you left out the mycompany.com it would locate objects using LDAP. You would have to have a DNS zone for mycompany.com so that things the location of DC's could be found when needed by authentication and the likes. Windows 2000 Active Directory actualy uses two industry standards for naming. LDAP and DNS. These are both used in different ways. LDAP is used to find objects. DNS is used to find physical resouces, which would lead back to problems of finding resouces from one domain to the other.

by ntoz

3. A forest is two or more separate AD trees jointed together by a trust, so the answer is yes

4. When you add the domain to the tree, a two way trust is automaticaly created.

5. If your going to do this and still want separate domains becauseof bandwidth and the likes, use the mycompany.com root, us.mycompany.com/france.mycompany.com as the method. I would also use fr instead because its short and is the same as the designator for DNS's root for france.

This discussion is closed to new replies.